Enter the signing secret and the expiry. Both are written into the token as sent and published to the device.